Security by minimizing data movement.

What we designed: Files you select are parsed by JavaScript on your device. SOV Lens v1.2.1 does not include a customer data upload endpoint, account database, telemetry, advertising scripts, or file-processing API.

Technical controls

Content Security Policy restricts scripts and styles to same-origin assets and disallows outbound application connections. The app builds result tables with text nodes, not HTML from uploaded spreadsheet cells. It limits CSV and XLSX file size and workbook decompression size and escapes potential spreadsheet-formula content in exported CSV files. The release has automated regression tests.

What is still outside this scope

Hosting providers can receive normal page-request metadata. Corporate browsers, devices, extensions, VPNs, DNS, download folders, and organization policies can change the environment. Browser-only processing is not the same thing as a fully audited or certified security system. We have not completed an independent penetration test, SOC 2 audit, legal assessment, or enterprise procurement review.

Approval before confidential use

Obtain your employer's written approval before processing confidential third-party schedules or other regulated data. Try the fictional sample first. No employee should bypass their internal security policies on the basis of this page.

Reporting security concerns

This public release requires a verified operator support and security contact before broad distribution. Until then, do not send real confidential files or security disclosures through unverified channels.

Maintainer action: add a verified support/security contact and review this page before a commercial launch.